Many organizations such as health care organizations, financial organizations, manufacturing organizations, etc. use data loss prevention (DLP) products to monitor and protect unstructured data. DLP products detect user activity on data, and determine whether the data contains confidential information. The DLP products then perform predetermined actions when they determine that the data contains confidential information. However, conventional DLP products do not determine normal user behavior or identify anomalous user behavior with regards to data accesses.